Digital contact tracing has been at the centre of global concerns about privacy and digital rights during the Covid-19 pandemic.
In March 2020, South Africa joined dozens of other countries in looking for sophisticated technological solutions to aid its contact-tracing efforts, with an ambitious if misguided attempt to use locational data from mobile-network operators to help ‘track and trace’ people with the virus.
While the programme was misconceived – officials abandoned the attempt to use cellular data for contact tracing after just a few weeks – it did yield a novel set of privacy protections designed to ensure oversight and safeguard against its misuse.
In doing so, South Africa appeared in one way to eschew a common global narrative about privacy in the pandemic: that crises provoke emergency powers that are only ever excessive, expansive and ever-lasting.
Since then, South Africa’s health authorities’ evolving approach to contact tracing has shifted to a range of other digital interventions that seem more carefully considered, but that have often been put into effect with little public consultation and haphazard transparency.
This report attempts to piece together a public record (albeit incomplete) of how the initial digital contact-tracing policy was created, why it failed, and what came next. In doing so it gives a first assessment of some the privacy and data protection issues that emerged, and a critical reflection on the challenges of policy making in a time of crisis, where well-intentioned officials grapple with complex problems under immense pressure.